[Pkg-rust-maintainers] Bug#1085296: rust-pyo3: CVE-2024-9979

[Moritz Mühlenhoff]

Source: rust-pyo3
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-pyo3.

CVE-2024-9979[0]:
| A flaw was found in PyO3. This vulnerability causes a use-after-free
| issue, potentially leading to memory corruption or crashes via
| unsound borrowing from weak Python references.

https://github.com/PyO3/pyo3/pull/4590
https://rustsec.org/advisories/RUSTSEC-2024-0378.html


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-9979
    https://www.cve.org/CVERecord?id=CVE-2024-9979

Please adjust the affected versions in the BTS as needed.